AzureFunctionProxy

AzureFunctionProxy is an Azure Functions proof of concept for proxying HTTP traffic through a function endpoint on Azure Functions 4 with the .NET 10 isolated worker model.

This repository is a security research POC. Use it only in systems and environments you are authorized to test. Do not send real credentials or production session material through a test deployment.

Capabilities

• Acts as an application-layer MITM-style HTTP proxy between the client and the configured upstream target.
• Accepts GET, POST, and PUT requests on /api/runapp.
• Preserves and forwards the request query string to the upstream target.
• Reads request bodies using the request charset.
• Writes non-empty request bodies to the queue Azure Storage Queue.
• Forwards incoming client cookies to the upstream request.
• Rewrites upstream response cookies before returning them to the client.
• Reduces emitted response cookies to the POC's reduced attribute set, enabling cookie-attribute downgrade behavior.
• Stores the final upstream request URI in the referer response cookie.
• Reuses the referer cookie as the outbound Referer header on subsequent requests.
• Rewrites proxied response content using configured replacement rules.
• Returns the upstream response status, content type, and rewritten body.
• Supports an optional outbound User-Agent override through configuration.
• Supports debug logging for request query, body, and proxy target details.
• Redirects GET / to /api/runapp.
• Runs on Azure Functions 4 with the .NET 10 isolated worker model.
• Includes GitHub Actions workflows for build and Azure deployment.

Request flow

GET /
  -> 301 /api/runapp

GET|POST|PUT /api/runapp?<query>
  -> read request body using request charset
  -> optionally enqueue the decoded body
  -> forward the request to https://github.com/osysltd/?<query>
  -> apply configured response content replacements
  -> emit proxied response status/content type/body
  -> emit rewritten cookies + referer cookie

The current upstream target is https://github.com/osysltd/. The request query string is appended to the upstream URL.

Requirements

• .NET SDK 10.0.401 or a compatible patch version allowed by global.json
• Visual Studio 2026 18.9 or later when building in Visual Studio on Windows
• Azure Functions Core Tools 4.x
• Azure Storage account, or Azurite for local queue storage

Local configuration

Copy the example settings file:

cp local.settings.example.json local.settings.json

Relevant settings:

Setting	Purpose
AzureWebJobsStorage	Storage connection used by the queue output binding.
FUNCTIONS_WORKER_RUNTIME	Must be dotnet-isolated.
UserAgent	Optional outbound User-Agent header.
debug	Set to true to log request query/body and proxy target details.

local.settings.json is ignored by Git.

Run locally

dotnet restore
dotnet build
func start

Then use:

http://localhost:7071/
http://localhost:7071/api/runapp

Deployment

The deployment workflow publishes the isolated-worker project and deploys the publish output with the Azure Functions GitHub Action.

The Azure Function App must be configured for Functions runtime 4 and .NET isolated worker. For .NET 10 on Linux, use a supported hosting plan such as Flex Consumption.

License

See LICENSE.